SignTool now expects you to choose the digest algorithms. Set /fd for the file digest when signing and /td for the timestamp digest when using an RFC 3161 timestamp server with /tr. Microsoft recommends SHA256. If you leave them out, you get a warning today and an error in later versions.
Definitions
A file digest is the hash of the file that the signature covers. A timestamp digest is the hash used in the request to the timestamp server. RFC 3161 is the standard protocol for such servers, which SignTool selects with the /tr option.
What Microsoft says
The SignTool page states that builds of the Windows SDK, HLK, WDK and ADK numbered 20236 and later require you to specify the digest algorithm. The sign command requires /fd during signing and /td during timestamping. If they are missing, the command first throws a warning with error code 0. In later versions the warning becomes an error. Microsoft recommends SHA256, and notes that SHA384 and stronger need Windows 11 or Windows 10 with the November 2022 update.
The flags in one table
| Option | Purpose |
|---|---|
| /fd | File digest algorithm for the signature |
| /tr | URL of an RFC 3161 timestamp server |
| /td | Digest algorithm for the timestamp request, used with /tr |
| /t | URL of an older style timestamp server, cannot be used with /tr |
Microsoft states that if you specify neither /t nor /tr, the signed file is not timestamped, and that failure to timestamp produces a warning.
A correct signing and verifying pair
signtool sign /f MyCert.pfx /fd SHA256 /tr https://timestamp.example.com /td SHA256 MyApp.exe
signtool verify /pa /tw MyApp.exe
Replace the timestamp URL with the server your certificate authority publishes. On verification, Microsoft documents /pa for the default authentication policy and /tw to warn if the signature is not timestamped. Without /pa, SignTool uses the Windows Driver Verification Policy, so be explicit.
Keep a PFX password out of the command line where you can. A password on a command line may be visible to other processes. For team use, a hardware or cloud key store is better than a PFX file, as covered at /resources/blog/where-to-keep-code-signing-keys-hardware-and-cloud-signing.
Exit codes your CI should respect
SignTool returns 0 for success, 1 for failure and 2 for completed with warnings. A pipeline that only checks for non-zero will fail on warnings, which is the safer default. A pipeline that only checks for 1 will pass an untimestamped signature. Decide on purpose, and prefer failing on 2 for release builds.
Other options worth knowing
- /a selects the valid certificate with the longest validity automatically. Without it, SignTool expects to find exactly one valid certificate.
- /as appends a signature rather than replacing it, which matters for dual signing.
- /sha1 selects a certificate by its thumbprint when several match. The thumbprint name is a certificate selector, not a signature digest.
A pre-release check
- Both /fd and /td appear in your signing script.
- The script uses /tr, not /t.
- The verify step uses /pa and /tw.
- The build fails on exit code 2 for release.
A related walkthrough of the verification step is at /resources/blog/verify-a-windows-installer-signature-with-signtool.
Where Safeguard fits
Digest settings protect the signature itself. Safeguard checks the dependencies in the build, with SBOMs and a free scan at gold.safeguard.sh/scan.
Quick check
Is /td needed if I use /tr?
Yes. Microsoft says /td is used with /tr to set the digest algorithm for the RFC 3161 timestamp request, and leaving it out gives a warning or an error.
What does exit code 2 mean?
SignTool completed with warnings. Treat it as a failure for release builds so an untimestamped signature does not slip through.
Sources
Last reviewed: 19 October 2026.
